示例#1
0
        private void fileOpenCheck(String fileName)
        {
            HexReader hexReader = new HexReader(fileName);
            long      signature = hexReader.readLong(4);

            if (signature != 6736818458095L)
            {
                MessageBox.Show("Please open the correct file", "This file is not ESE database", MessageBoxButtons.OK, MessageBoxIcon.Error);
                return;
            }
            hexReader.close();

            FormInputUTCTime formInputUTCTime = new FormInputUTCTime();
            DialogResult     dialogResut      = formInputUTCTime.ShowDialog();

            if (dialogResut == DialogResult.OK)
            {
                // Read the contents of testDialog's TextBox.
                UTCTime = formInputUTCTime.getUTCTime();
                String[] Time = UTCTime.Replace("UTC-", "").Replace("UTC+", "").Split(':');

                if (Time.Length == 1)
                {
                    UTCAddHour = Time[0];
                }
                else if (Time.Length == 2)
                {
                    UTCAddHour   = Time[0];
                    UTCAddMinute = Time[1];
                }
            }
        }
示例#2
0
        public bool fileOpen(string path)
        {
            try
            {
                HexReader hexReader = new HexReader(path);
                long      signature = hexReader.readLong(4);
                if (signature != 6736818458095L)
                {
                    MessageBox.Show("Please open the correct file", "This file is not ESE database", MessageBoxButtons.OK, MessageBoxIcon.Error);
                    this.filePath             = "";
                    this.textBoxFilePath.Text = this.filePath;
                    hexReader.close();
                    return(false);
                }
                this.filePath             = path;
                this.textBoxFilePath.Text = this.filePath;
                int status = hexReader.readInt(0x34);
                if (status == 2)
                {
                    this.labelFileStatus.Text   = "File status : Dirty";
                    radioButtonUsingAPI.Enabled = false;
                    radioButtonParsing.Checked  = true;
                }
                else
                {
                    this.labelFileStatus.Text   = "File status : Clean";
                    radioButtonUsingAPI.Enabled = true;
                    radioButtonUsingAPI.Checked = true;
                    DateTime currTime = DateTime.Now;
                    String   time     = currTime.ToString("yyyy") + "_" + currTime.ToString("MM") + "_" + currTime.ToString("dd") + "__" + currTime.ToString("HH_mm_ss");
                    workingDirectory             = Path.GetTempPath() + @"IE10Analyzer_" + time + @"\" + Path.GetFileName(textBoxFilePath.Text);
                    textBoxWorkingDirectory.Text = workingDirectory;
                }


                hexReader.close();
                return(true);
            }
            catch
            {
                MessageBox.Show("Can not open the file", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
                return(false);
            }
        }
示例#3
0
        public void openAPI(String fileName, String workingDirectoryPath)
        {
            useAPI         = true;
            recoveryRecord = false;
            parseRecord    = false;
            carveRecord    = false;
            edbParserManager.colse();
            HexReader hexReader;

            try
            {
                hexReader = new HexReader(fileName);
            }
            catch
            {
                MessageBox.Show("This file is currently in use", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
                return;
            }
            long signature = hexReader.readLong(4);

            if (signature != 6736818458095L)
            {
                MessageBox.Show("Please open the correct file", "This file is not ESE database", MessageBoxButtons.OK, MessageBoxIcon.Error);
                return;
            }

            int status = hexReader.readInt(0x34);

            if (status == 2)
            {
                MessageBox.Show("Error : Use Open(parsing)", "This file is Dirty status", MessageBoxButtons.OK, MessageBoxIcon.Error);
                return;
            }
            pageSize = hexReader.readInt(236);
            hexReader.close();

            FormInputUTCTime formInputUTCTime = new FormInputUTCTime();
            DialogResult     dialogResut      = formInputUTCTime.ShowDialog();

            if (dialogResut == DialogResult.OK)
            {
                // Read the contents of testDialog's TextBox.
                UTCTime = formInputUTCTime.getUTCTime();
            }

            formInputUTCTime.Dispose();



            try
            {
                FastCopy(fileName, workingDirectoryPath);
            }
            catch
            {
                MessageBox.Show("This file is currently in use", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
                return;
            }

            fileName = workingDirectoryPath;
            try
            {
                if (!esentManager.Initialize(fileName, pageSize))
                {
                    MessageBox.Show("This file is not WebCacheV01.dat(Internet Explorer DB)", "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
                    return;
                }

                String[] Time = UTCTime.Replace("UTC-", "").Replace("UTC+", "").Split(':');
                this.UTCAddHour   = "0";
                this.UTCAddMinute = "0";
                if (Time.Length == 1)
                {
                    UTCAddHour = Time[0];
                }
                else if (Time.Length == 2)
                {
                    UTCAddHour   = Time[0];
                    UTCAddMinute = Time[1];
                }
                esentManager.setUTCTime(UTCAddHour, UTCAddMinute);
                dockTableList.clearList();
                openFileUsingAPI();

                return;
            }
            catch (Exception ex)
            {
                MessageBox.Show(ex.Message.ToString(), "Error", MessageBoxButtons.OK, MessageBoxIcon.Error);
            }
        }